In CrowdStrike Falcon Machine Learning (ML) exclusion patterns, a single asterisk () functions as a wildcard that matches any number of characters, including zero characters. However, its matching is constrained to a single file or directory name; it will not match path separator characters such as a backslash (\) on Windows or a forward slash (/) on macOS/Linux. To create a pattern that spans across multiple directory levels, a double asterisk () must be used, as it is the wildcard that matches path separators.

A. This option incorrectly describes the function of a double asterisk (), which is used to match any number of characters including path separators.

C. The single asterisk is a wildcard for pattern matching file paths and does not function as an insertion point for a variable list.

D. The asterisk is a versatile wildcard that can be used in any part of a path expression, not just at the start to represent a drive letter.

1. CrowdStrike Falcon® Documentation

Prevention Policy Settings Guide

"Exclusions" section

"Wildcard Support in Exclusions" subsection. The documentation explicitly states: "The single asterisk () matches any number of characters. The single asterisk does not match directory separators (\ or /)." This directly confirms that the wildcard is limited to a single path segment.

2. CrowdStrike Falcon® Documentation

Sensor for Windows: Deployment Guide

"Exclusion Examples" section. The examples provided illustrate this principle. For instance

an exclusion for C:\Users\\temp.exe would match C:\Users\jsmith\temp.exe but would not match C:\Users\jsmith\documents\temp.exe. To match the latter

the pattern C:\Users\\temp.exe would be required.